From 5ba5c3108a1725ce7ece798a2944047328eaeeeb Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Tue, 7 Jul 2026 10:26:36 +0200 Subject: [PATCH 1/2] =?UTF-8?q?authentik:=20Passkey-only=20Login=20auch=20?= =?UTF-8?q?f=C3=BCr=20Audiobookshelf=20und=20Immich?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bindet die OAuth2-Provider Audiobookshelf und immich-oauth-provider an den Passwordless-Authentication-Flow (Passkey-Autofill inklusive) und den Step-up-Authorization-Flow — gleiche Mechanik wie Home Assistant und NetBird (#115/#118). Pflichtfelder (invalidation_flow, client_type, redirect_uris) spiegeln den Live-Stand vom 2026-07-07. Nutzerabdeckung geprüft: Audiobookshelf Users (k.renner, s.renner) haben Passkeys; Immich Users enthält g.renner ohne Passkey — sie bekommt beim ersten Zugriff das Inline-Enrollment über die Step-up- Stage (configure), kein Lockout. Co-Authored-By: Claude Fable 5 --- .../apps/authentik/blueprints-configmap.yaml | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 868f5e36..65484bdb 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -803,3 +803,35 @@ data: matching_mode: strict - url: 'https://netbird\.renner\.uno(/.*)?' matching_mode: regex + + - model: authentik_providers_oauth2.oauth2provider + identifiers: + name: Audiobookshelf + state: present + attrs: + authentication_flow: !KeyOf passkey-passwordless-flow + authorization_flow: !KeyOf passkey-stepup-flow + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + redirect_uris: + - url: https://audiobooks.renner.uno/auth/openid/callback + matching_mode: strict + - url: https://audiobooks.renner.uno/auth/openid/mobile-redirect + matching_mode: strict + + - model: authentik_providers_oauth2.oauth2provider + identifiers: + name: immich-oauth-provider + state: present + attrs: + authentication_flow: !KeyOf passkey-passwordless-flow + authorization_flow: !KeyOf passkey-stepup-flow + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + redirect_uris: + - url: app.immich:///oauth-callback + matching_mode: strict + - url: https://immich.renner.uno/auth/login + matching_mode: strict + - url: https://immich.renner.uno/user-settings + matching_mode: strict From eac9a6cd6f1147361130ba010a18d89767eae556 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Tue, 7 Jul 2026 10:32:05 +0200 Subject: [PATCH 2/2] =?UTF-8?q?authentik:=20Passkey-only=20Login=20auch=20?= =?UTF-8?q?f=C3=BCr=20Gitea=20und=20Grafana?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Beide Provider (nur k.renner via Infrastructure Admins, 4 Passkeys enrolled) an den Passwordless- und Step-up-Flow gebunden; Live-Stand der Pflichtfelder gespiegelt. PVE, PBS und paperless-gate bleiben bewusst auf Passwort+MFA. Co-Authored-By: Claude Fable 5 --- .../apps/authentik/blueprints-configmap.yaml | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 65484bdb..e08981ab 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -835,3 +835,32 @@ data: matching_mode: strict - url: https://immich.renner.uno/user-settings matching_mode: strict + + - model: authentik_providers_oauth2.oauth2provider + identifiers: + name: Provider for Gittea + state: present + attrs: + authentication_flow: !KeyOf passkey-passwordless-flow + authorization_flow: !KeyOf passkey-stepup-flow + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + redirect_uris: + - url: https://gitea.renner.uno/user/oauth2/authentik/callback + matching_mode: strict + + # PVE, PBS and paperless-gate deliberately stay on the default + # implicit-consent flow (password + MFA) — passkey-only covers + # the daily-driver apps above. + - model: authentik_providers_oauth2.oauth2provider + identifiers: + name: Provider for Grafana + state: present + attrs: + authentication_flow: !KeyOf passkey-passwordless-flow + authorization_flow: !KeyOf passkey-stepup-flow + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + redirect_uris: + - url: https://dash.renner.uno/login/generic_oauth + matching_mode: strict